开发者

Is OAuth irrelevant when HTTPS is used?

I am designing a RESTful API which will always communicate over HTTPS. Is there any reason to use a scheme like OAuth when running over HTTPS? I am particularly intere开发者_如何学Gosted whether or not aspects like HMAC-signed requests, nonces, and timestamps are useful when the entire communication is encrypted.

It seems like any authentication scheme over HTTPS is sufficient but I just wanted to get a second opinion.


Well, that's the whole theory behind OAuth 2. Instead of the complicated signature mechanisms of OAuth 1, you just rely on transport-layer security and focus on the authorization piece of the puzzle. The HTTPS protocol does not solve the authorization piece, so you still need OAuth 2 for that.

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜